Quantcast
Channel: THWACK: Message List - Security Event Manager (SEM) - Formerly Log & Event Manager
Viewing all articles
Browse latest Browse all 5385

Re: How to capture failed 'Run as Administrator' events on a Windows domain?

$
0
0

I guess I should have specified that in our case, the Run As Administrator attempts are being initiated with different credentials (same domain) than the currently logged on user. So this answer makes sense in some cases, but when specifying different user credentials, the current authentication token wouldn't be valid so the process would have to go back to the DC to validate the new credentials, right?


Viewing all articles
Browse latest Browse all 5385

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>